It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor
likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX and Anthropic have extensive business ties)
I don't think Spacex cares at all about Anthropics IPO just because they rent out their compute.
Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.
loading story #50302940
OpenVSX has no extension signing, no verification, nothing...
So really, there's no way to say what was compromised and where.
This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed
loading story #50311690
loading story #50311525
> Cursor routes extension search and downloads through its own marketplace proxy (marketplace.cursorapi.com), not a direct passthrough to Open VSX.